tPj6 dZddlZddlZddlmZmZmZddlmZmZm Z ddl Z ddl m Z ddl Z ddlmZmZddlmZddlmZmZmZmZmZmZdd lmZdd lmZdd lmZdd l m!Z!m"Z"m#Z#m$Z$dd l%m&Z&ddl'm(Z(ddl)m*Z*de+de+de+ddfdZ,de+dzde-e+e+ffdZ.GddZ/de+de+de+dzde!dzde/f dZ0de1fdZ2de*de+de+fdZ3de/d e4d!e5de*fd"Z6y)#z Login utilities for handling user authentication in the proxy server. This module contains the core login logic that can be reused across different login endpoints (e.g., /login and /v2/login). N)datetime timedeltatimezone)FinalLiteralcast) HTTPException)LITELLM_PROXY_ADMIN_NAMELITELLM_UI_SESSION_DURATION)duration_in_seconds)LiteLLM_UserTableLitellmUserRolesProxyErrorTypesProxyExceptionUpdateUserRequestUserAPIKeyAuth) user_update)generate_key_helper_fn),get_disabled_non_admin_personal_key_creation) PrismaClientget_server_root_path hash_passwordverify_password)UserRepository)get_secret_bool)ReturnedUITokenObjectuser_idpasswordstoredreturncK|jdryddlm}|Rehash legacy password (SHA256) to scrypt on successful login.zscrypt:Nr) prisma_clientrr)wheredata) startswithlitellm.proxy.proxy_serverr"rtableupdater)rrrr"s c/home/oem/CyberBrain26-unified/.venv/lib/python3.12/site-packages/litellm/proxy/auth/login_utils.py_rehash_password_if_neededr*-sg #8 ]+1188g&mH569   ! sAAAA master_keyctjdd}tjdd}|| t|nd}|tdtj dd||fS)aU Get UI username and password from environment variables or master key. Args: master_key: Master key for the proxy (used as fallback for password) Returns: tuple[str, str]: A tuple containing (ui_username, ui_password) Raises: ProxyException: If neither UI_PASSWORD nor master_key is available UI_USERNAMEadmin UI_PASSWORDNzset Proxy master key to use UI. https://docs.litellm.ai/docs/proxy/virtual_keys. If set, use `--detailed_debug` to debug issue.messagetypeparamcode)osgetenvstrrr auth_error)r+ ui_username ui_passwords r)get_ui_credentialsr<:so=':K))M40K)3)?c*oT V ++    ##c |eZdZUdZeed<eed<edzed<eed<eded< d dedededzdededf d Zy) LoginResultz8Result object containing authentication data from login.rkeyN user_email user_role)ssousername_password login_methodcJ||_||_||_||_||_y)Nrr@rArBrE)selfrr@rArBrEs r)__init__zLoginResult.__init__^s( $"(r=)rD)__name__ __module__ __qualname____doc__r8__annotations__rrIr=r)r?r?UsoB L Hd N455=P ) ) )$J )  ) 89 )r=r?usernamer"cK|tdtjddt|\}}d}d}|Ct t dzt |jjd|ddi d{} tj|jd |jd rtj|jd |jd rtj}t}t} tj d dtj"d |k(s |tk(rtj d t} t%t'| | t)tj d{tj d@t+d(dditjt,t.j0giid| dd d{} ntdtjdd| d} t3drNddlm} d} ||} n|t ||gt.j0} | t9dddi| j;| } t=|| d|dS|4 t?|d d!}t?|d"tj@}t?|dd!}t?|d#d!}|td$tjd#dtC||rtE|jF||d{tj d2t+d(ddi|t,t.j0giid|dd d{} ntdtjdd| d} t=|| |t tH|dStd%|tjd&dtd'tjd&d7K7<777w))ap Authenticate a user and generate an API key for UI access. This function handles two login scenarios: 1. Admin login using UI_USERNAME and UI_PASSWORD 2. User login using email and password from database Args: username: Username or email from the login form password: Password from the login form master_key: Master key for the proxy (required) prisma_client: Prisma database client (optional) Returns: LoginResult: Object containing authentication data Raises: ProxyException: If authentication fails or required configuration is missing NzMaster Key not set for Proxy. Please set Master Key to use Admin UI. Set `LITELLM_MASTER_KEY` in .env or set general_settings:master_key in config.yaml. https://docs.litellm.ai/docs/proxy/virtual_keys. If set, use `--detailed_debug` to debug issue.r+r0r1rA insensitive)equalsmode)r#zutf-8PROXY_ADMIN_ID)rrB)rB)r$user_api_key_dict DATABASE_URL request_typer@rzlitellm-dashboard) rBdurationkey_max_budgetmodelsaliasesconfigspendrteam_idz_No Database connected. Set DATABASE_URL in .env. If set, use `--detailed_debug` to debug issue.tokenEXPERIMENTAL_UI_LOGIN)ExperimentalUIJWTToken)rrBr[ max_budgetierrorz6User Information is required for experimental UI login) status_codedetailrDrGrunknownrBrzPUser has no password set. Please set a password for the user via `/user/update`.zAInvalid credentials used to access UI. Not valid credentials for invalid_credentialszVInvalid credentials used to access UI. Check 'UI_USERNAME', 'UI_PASSWORD' in .env filerO)%rrr9r<rr rr' find_firstsecretscompare_digestencoder PROXY_ADMINr r6r7environrrrrr litellmmax_ui_session_budgetrlitellm.proxy.auth.auth_checksrbr (get_experimental_ui_login_jwt_auth_tokenr?getattrINTERNAL_USER_VIEW_ONLYrr*rr8)rPrr+r"r:r; _user_rowrBr key_user_idresponser@rb user_inforA _passwords r)authenticate_userrzms82P ++    2*=K+/I    $ /55@@#-%PQA   hoog6 8J8J78STY`YoYo +"4"4W"=Z%00 */ II& - 9bjjIY>Z^e>e 0 0))$46NOK "##-*66     99^ $ 03 " "2!=!= ;&-&C&C ! *2   H!y$//$  w 2 3 M26I$% $-#'&<<   # ##%]^ )QQR[\C,      )Y :I{4D4\4\] #I|YG "9j)D   j$//    8Y /,Y->->)T T Tyy(4!7 "!& "&/$?*1*G*G"$#%"$!"#*#6  " %}(33( 7#C%sI.0  !\]e\fg$//+  m ++'   s 8  R U s_A.O0N; 1DON>AOODO2O3AO8O9BO>OOOOctt}ttjt j t|zjS)aThe ``exp`` claim (unix seconds) for a UI session cookie, ``LITELLM_UI_SESSION_DURATION`` from now. The virtual key sealed inside the cookie already expires after this same duration; stamping the JWT itself gives the cookie the bounded lifetime the dashboard's client-side expiry check and the server-side session-cookie readers both assume, instead of a token that stays signature-valid until the master key rotates.)seconds) r r intrnowrutcr timestamp) ttl_secondss r)_ui_session_exp_timestampr@s: --HIK  X\\*Y{-KKVVX YYr=returned_ui_token_objectcnitt|dti}tj||dS)aEncode a UI session cookie JWT with a bounded ``exp``. The single choke point every UI login path (SSO and username/password /login, /v2, /v3) uses to mint the ``token`` cookie, so the cookie's lifetime is set in exactly one place and cannot drift between paths. Without the ``exp`` the cookie is valid until the master key rotates, and the session-cookie readers that require a bounded lifetime (the MCP interactive sign-in) reject it. expHS256) algorithm)rdictrjwtrl)rr+claimss r)encode_ui_session_jwtrJs5atD":;`UD]D_`F ::fjG <rs? 22'' !SJS @8<  c  S  #  RV  $3:$%S/$6))0P P P d P  $& P  P fZ3Z =4I =WZ =_b = r=